FIND NEWAE TECHNOLOGY PRODUCTS ON MOUSER ELECTRONICS
.png)
ChipSHOUTER Kit
MSRP:
$3300 USD
The ChipSHOUTER® (CW520) is a fully-featured Electromagnetic Fault Injection (EMFI) platform that can be used to discover and characterize vulnerabilities in embedded systems. ChipSHOUTER makes EMFI available to test labs, engineering development firms, educators, and embedded enthusiasts. With a flexible API and bundled practice targets, the system is a platform for experimentation and education right out of the box. Paired with an X-Y table and basic python scripting the ChipSHOUTER becomes a fully automatable EMFI platform capable of precision testing and fault characterization. This kit is designed for conducting attacks and testing in-situ, without the need to use special development boards or to modify the target board.
ChipSHOUTER uses low-ESR capacitors to dump up to 500V through various E.M. probes. Digital control of charge voltage and fast response times provide you with the E.M. fault injection tool to simplify your fault investigations. Electromagnetic Fault Injection is a powerful attack method that requires careful consideration of how it might apply to your products.
Learn more about EMFI here.
White Paper: Electromagnetic Fault Injection (EMFI) for Automotive Safety & Security Testing with ChipSHOUTER®
Features
150 to 500 V Charge Voltage.
Hardware input with sub-nS jitter, allowing highly accurate injection timings.
Python API for easy control and scripting.
Oscilloscope output monitors to see actual glitch inserted into probe tip.
Comes with 4 probe tips of varying size and polarities.
Included Ballistic Gel & Simple EMFI Target for validating EMFI settings.
Optional cooling air input for near-continuous use.
Ballistic Gel EMFI Target
A unique SRAM-based EMFI target includes a large SRAM array. By injecting faults into the array, you can count individual bit flips occurring with different pulse parameters. You can even see some physical location effects by mapping the SRAM location to address location.
Built for Scripting
The Python 3 API easily allows usage with existing systems, such as connecting an XY table to the ChipSHOUTER setup to scan a device surface.
The ChipSHOUTER also features a simple serial terminal to allow you to use the unit interactively.
Hardware Trigger Input
A built-in pulse generator allows generating pulses on computer command. For a high-resolution temporal location, a hardware trigger input directly drives the pulse output. This can be controlled by a ChipWhisperer, pulse generator, or custom FPGA board.
Documentation
Specifications
Charge Voltage Range | 150V to 500V |
Charge Energy | 625 mJ |
Inserted Pulse Min Width (1mm tip) | 15 nS (TYP) |
Inserted Pulse Max Width (1mm tip) | 80 nS (TYP) |
Inserted Pulse Min Width (4mm tip) | 24 nS (TYP) |
Inserted Pulse Max Width (4mm tip) | 480 nS (TYP) |
Hardware Input Trigger: Delay (Typ) | 75 nS (TYP) |
Hardware Input Trigger: Delay Jitter | 150 pS std-dev (TYP) |
Hardware Input Trigger: Width Jitter (300 to 500V) | 220 pS std-dev (TYP) |
Packing List
ChipSHOUTER Main Unit | ChipSHOUTER CW520 Main Device | 1 | |
Ballistic Gel Target | CW521 Ballistic Gel SRAM Target Board | 1 | |
USB A Cable | USB cable for CW521 Ballistic Gel | 1 | |
Simple EMFI Target | CW322 Simple EMFI Target + Battery | 1 | |
Injection Probe Tip Set | 1mm, 4mm probe tip set (4 probes total) | 1 set | |
Oscilloscope probe adapter | Oscilloscope probe adapters for Voltage & Current Measurement | 2 | |
Isolated USB Interface | Isolated USB-Serial Adapter | 1 | |
RJ12 Serial Cable | RJ12 Straight-Thru Data Cable | 1 | |
Micro-USB Cable (3 ft) | Micro-USB Cable for Isolated USB-Serial Adapter | 1 | |
SMB to SMA Adapter | SMA adapter for hardware pulse input connector | 1 | |
SMB to BNC Adapter | BNC adapter for hardware pulse input connector | 1 | |
SMB Cable | SMB cable for hardware pulse input connector | 1 | |
Coolin air adapter | Flex tube adapter for air inlet | 1 | |
4mm wrench | Wrench to remove air adapter blanking plug | 1 | |
Right angle SMA Adapter | Adapter when mounting ChipSHOUTER horizontally | 1 |
